Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 276d58f0ebad4e247f0e6d2b7c816c54
Size: 1.7 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 276d58f0ebad4e247f0e6d2b7c816c54
Sha1 d4a019c91ccb29e1c855bf9959693d8bf9eef63f
Sha256 82ff923d129e20cf751804ebebf90e87ba49501cefb77d0abd0fba54de9d2515
Sha384 50ff91be3606411937dcfd7529642374cbd553228354e28df0953acf103efe55e6c67179ed847abeb4bd179395ef6043
Sha512 7aa9850ec93e867678069355921849f40384780cbd079e2689a6a10f28649fd9d2aba9e3e9561a47cc25f1e6ab508e5451b192c568e705594f194faeee1acb92
SSDeep 49152:jhEWltMmiHmjssQK5AXoMbCbVfeG3NN53PF:GIviGjZQKAnbCAWfF
TLSH FF75E03374E28437E9A604B14EE91B15AFBAE6330438CC8B67C42D497765DC3D22A767
PeID
Armadillo v2.xx (CopyMem II)Microsoft Visual C++ 6.0 - 8.0Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 7.1Microsoft Visual C++ v6.0 DLLMicrosoft Visual C++ v7.0UPX v2.0 -> Markus, Laszlo & Reiser
276d58f0ebad4e247f0e6d2b7c816c54
7z-stream @ 0x00174616.7z
4areg.exe
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:1033
Overlay_f7045bb4.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
UPX0
UPX1
.rsrc
.imports
Resources
SCRIPT
ID:0065
ID:2052
ID:0067
ID:2052
RT_DIALOG
ID:271B
ID:2052
ID:271C
ID:2052
ID:271D
ID:2052
ID:271E
ID:2052
ID:2720
ID:2052
ID:2723
ID:2052
RT_MANIFEST
ID:0001
ID:2052
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_f7045bb4.bin (172074 bytes)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙